RtlpOpenImageFileOptionsKeyEx

NTSTATUS __fastcall RtlpOpenImageFileOptionsKeyEx(_UNICODE_STRING *a3, INT64 a2, INT64 r8_0, VOID **a4){
  unsigned int Length; 
  char *v6; 
  unsigned int v8; 
  unsigned int v9; 
  bool v10; 
  NTSTATUS result; 
  INT64 v12; 
  _HANDLE v13; 
  unsigned int v14; 
  bool v15; 
  _UNICODE_STRING *v16; 
  int v17; 
  VOID *v18; 
  __int128 i; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *Handle; 
  VOID *KeyHandle; 

  *a4 = 0i64;
  Length = a3->Length;
  KeyHandle = 0i64;
  v6 = (char *)a3->Buffer + Length;
  v18 = 0i64;
  v8 = Length;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  for( i = 0i64; v8; v8 -= 2 )
  {
    if( *((_WORD *)v6 - 1) == 92 )
      break;
    v6 -= 2;
  }
  v9 = Length - v8;
  *((_QWORD *)&i + 1) = v6;
  LOWORD(i) = v9;
  if( (unsigned __int16)v9 != v9 )
    return -1073741789;
  v10 = *(&stru_140CF2E80 + 1818) != 0;
  result = RtlpOpenBaseImageFileOptionsKey(&KeyHandle);
  if( result >= 0 )
  {
    v13 = (int)KeyHandle;
    v14 = 1600;
    v15 = KeGetCurrentThread()->PreviousMode == 1;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = KeyHandle;
    if( !v15 )
      v14 = 576;
    ObjectAttributes.Attributes = v14;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&i;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v17 = ZwOpenKey(
            &v18,
            9ui64,
            &ObjectAttributes,
            v12,
            (INT64)v18,
            i,
            *((INT64 *)&i + 1),
            *(INT64 *)&ObjectAttributes.Length);
    if( v10 )
      ZwClose(v13);
    if( v17 >= 0 )
    {
      Handle = v18;
      v17 = RtlpProcessIFEOKeyFilter(&Handle, v16, a3);
      if( v17 < 0 )
      {
        if( Handle )
          ZwClose((_HANDLE)Handle);
      }
      else
      {
        *a4 = Handle;
      }
    }
    return v17;
  }
  return result;
}

Referenced by: